Add Ceph dashboard SAML provider #9

2026-07-19T02:22:40+10:00

unkinben commented

2026-07-19 02:22:40 +10:00

Why

The Ceph dashboard supports SSO via SAML 2.0 only (native OIDC isn't available — it's a tech-preview oauth2-proxy path we're skipping). So onboard it via an Authentik SAML provider + application. Ceph is an external Puppet-managed cluster; dashboard at dashboard.ceph.unkin.net.

Change

Add config/providers_saml/ceph.yaml: SP entity id / ACS derived from the dashboard base URL — audience: .../auth/saml2/metadata, acs_url: .../auth/saml2 (HTTP-POST), signed with the built-in self-signed keypair.
Enhance the module's SAML path to resolve authorization/invalidation flows by slug and the signing keypair by name (mirrors the oauth2 handling). This path had never been exercised (no prior SAML providers), so it previously required raw UUIDs.

Validation

terragrunt plan: 2 to add (provider + application); flow slugs and the authentik Self-signed Certificate keypair resolve against live Authentik.

Ceph side (separate — Puppet, not in this repo)

On a mgr host (via profiles::ceph::dashboard exec or manually):

ceph dashboard sso setup saml2 https://dashboard.ceph.unkin.net <authentik-idp-metadata-url>

The Authentik IdP metadata URL comes from this provider once applied. If Ceph's generated SP entity id/ACS differ from the values here, reconcile them (ceph dashboard sso show saml2).

## Why The Ceph dashboard supports SSO via **SAML 2.0 only** (native OIDC isn't available — it's a tech-preview oauth2-proxy path we're skipping). So onboard it via an Authentik SAML provider + application. Ceph is an external Puppet-managed cluster; dashboard at `dashboard.ceph.unkin.net`. ## Change - Add `config/providers_saml/ceph.yaml`: SP entity id / ACS derived from the dashboard base URL — `audience: .../auth/saml2/metadata`, `acs_url: .../auth/saml2` (HTTP-POST), signed with the built-in self-signed keypair. - Enhance the module's SAML path to resolve authorization/invalidation flows by **slug** and the signing keypair by **name** (mirrors the oauth2 handling). This path had never been exercised (no prior SAML providers), so it previously required raw UUIDs. ## Validation `terragrunt plan`: 2 to add (provider + application); flow slugs and the `authentik Self-signed Certificate` keypair resolve against live Authentik. ## Ceph side (separate — Puppet, not in this repo) On a mgr host (via `profiles::ceph::dashboard` exec or manually): ``` ceph dashboard sso setup saml2 https://dashboard.ceph.unkin.net <authentik-idp-metadata-url> ``` The Authentik IdP metadata URL comes from this provider once applied. If Ceph's generated SP entity id/ACS differ from the values here, reconcile them (`ceph dashboard sso show saml2`).

unkinben added 1 commit 2026-07-19 02:22:40 +10:00

Add Ceph dashboard SAML provider

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline failed

Details

9c5937776e

Ceph dashboard SSO is SAML 2.0 (no native OIDC), so onboard it via an Authentik
SAML provider + application. Also resolve SAML authorization/invalidation flows
by slug and the signing keypair by name (mirrors the oauth2 handling), since the
SAML path had not been exercised before.

- config/providers_saml/ceph.yaml: SP entity id/ACS derived from the dashboard
  base URL (audience .../auth/saml2/metadata, acs .../auth/saml2, HTTP-POST),
  signed with the built-in self-signed keypair.

Ceph side (separate, Puppet): ceph dashboard sso setup saml2
  https://dashboard.ceph.unkin.net <authentik-idp-metadata-url>

Validated with `terragrunt plan`: 2 to add (provider + application).

benvin added 1 commit 2026-07-24 22:16:31 +10:00

Merge branch 'main' into benvin/ceph-saml

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

bd2ead5855

benvin merged commit 90e0ff1f6a into main

2026-07-24 22:41:52 +10:00

benvin deleted branch benvin/ceph-saml

2026-07-24 22:41:52 +10:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#9